topic Re: Quantum spark ipsec tunnel using vti interface in Firewall and Security Management

Quantum spark ipsec tunnel using vti interface

CheckCheckM — Sat, 28 Jan 2023 16:11:45 GMT

Hello all

Let me request quantum spark ipsec configuration guidr using vti if anyone have. Thanks.

Software version r81.10

Re: Quantum spark ipsec tunnel using vti interface

HeikoAnkenbrand — Sat, 28 Jan 2023 18:43:44 GMT

See Site to Site VPN R81 Administration Guide:

Route Based VPN

Re: Quantum spark ipsec tunnel using vti interface

G_W_Albrecht — Sun, 29 Jan 2023 07:34:59 GMT

For locally managed Quantum Spark:

https://sc1.checkpoint.com/documents/SMB_R81.10.00/AdminGuides/Locally_Managed/EN/Topics/Configuring-VPN-Sites.htm?tocpath=Appliance%20Configuration%7CManaging%20VPN%7C_____7

Re: Quantum spark ipsec tunnel using vti interface

G_W_Albrecht — Sun, 29 Jan 2023 07:34:18 GMT

This is Quantum Spark...

Re: Quantum spark ipsec tunnel using vti interface

Emilio_Espinosa — Thu, 16 Apr 2026 17:04:10 GMT

Link doesn't work anymore.

Besides, administration guide doesn't give instruction on how to set up a VPN using VTI but VTI itself.

Re: Quantum spark ipsec tunnel using vti interface

Emilio_Espinosa — Thu, 16 Apr 2026 17:12:17 GMT

Were you able to set up a VPN using VTIs?

Anyone?

Administration guide give instructions to set up VTI not VPN itself. According to Quantum admin guide, an empty group is required to be added as domain encryption in the VPN settings but Sparks won't allow it. Besides, the following note is indicated:
"InR81.10.00, static routes are not supported with a VPN Tunnel (VTI) as the Next Hop."
So, what's the point of having VTI?

In my case, I want to set up routing VPN in a locally managed SMB (1535, R81.10.17).

Sorry to revive an old thread but can't find proper instructions.

Re: Quantum spark ipsec tunnel using vti interface

Chris_Atkinson — Thu, 16 Apr 2026 23:22:22 GMT

Some examples:

https://support.checkpoint.com/results/sk/sk122256

https://support.checkpoint.com/results/sk/sk111733

https://support.checkpoint.com/results/sk/sk121740

Re: Quantum spark ipsec tunnel using vti interface

Emilio_Espinosa — Fri, 17 Apr 2026 00:46:04 GMT

Sweet!!

Thanks, Chris. It seems it's all there.

Re: Quantum spark ipsec tunnel using vti interface

Tom_Hinoue — Fri, 17 Apr 2026 01:26:51 GMT

Using VTIs (numbered or unnumbered) is supported even with locally managed Spark.
I was able to configure it in multiple scenarios such as AWS/GCP/Spark as peer and working.

Both static route with vti as nexthop and dynamic protocols like BGP works.
I remember there were some limitations back in R81.10.00 using VTIs (first release of embedded R81) but it should definitely work if you're running R81.10.17 and up.

Just make sure your VTI interface peer settings match the name of the VPN site name you created where you want to bind the VTI to.